@panphora/clayjs 1.5.3 → 1.6.1

package/src/sync/live-sync.js

@@ -56,9 +56,10 @@ import { presence } from './presence.js';
 import './section-notice.js';
 import { hostMeta } from '../core/host-meta.js';
 import { recordEtag, seedEtag, lastSeenEtag, conditionalSaves } from '../core/etag.js';
-import { pageMaybeDirty, pauseGate, resumeGate, gateCaptureToken, gateClearIfUnchanged, gateMarkDirty } from '../lib/dirty-gate.js';
+import { pageMaybeDirty, pauseGate, resumeGate, gateCaptureToken, gateClearIfUnchanged } from '../lib/dirty-gate.js';
 import { gestureSeen } from '../lib/user-gesture.js';
 import { SyncStream } from './stream.js';
+import { conflicts, beginApply, completeApply, failApply } from './conflicts.js';
 
 // What a live-sync merge never reads or touches on any side: editor chrome,
 // content kept out of the save or the snapshot, frozen regions, and nodes
@@ -209,15 +210,16 @@ class LiveSync {
     this._agreeSeq = 0;
     // The ticket of the save currently in flight, taken when it captured.
     this._saveTicket = 0;
-    // Conflicts an incoming frame won over this tab's unsaved text, kept until
-    // this tab's next successful save. While any are here the page stays
-    // dirty: no clean frame clears the gate or advances a saved baseline, and
-    // no automatic save runs from the merge path, so the close warning holds
-    // and the lost text stays reachable. Each entry is a hyper-morph conflict
-    // (`local` is the text this tab lost).
-    this.unresolvedConflicts = [];
-    // Each conflict's ticket: the moment its frame applied.
-    this._conflictTickets = new WeakMap();
+    // The peer lane's base carries a ticket from the same counter as the disk
+    // lane, so an accepted save and a frame install in the order the document
+    // held their bytes, not the order their promises settled.
+    this._peerBaseTicket = 0;
+    // The newest accepted save's capture ticket. A frame older than it does not
+    // adopt its own stamp: the save's response already recorded a newer one.
+    this._acceptedSaveTicket = 0;
+    // The ticket of the latest frame of either lane whose morph has run. The
+    // boot settle must not replace a base a morph already moved past.
+    this._morphTicket = 0;
     this.clientId = this.generateClientId();
 
     // Per-stream resume id for the htmlclay replay server's wire contract.
@@ -232,9 +234,9 @@ class LiveSync {
     // held so the commit relay can pair the host's stamp with the content that
     // stamp actually describes. Set at snapshot-ready, which fires before the
     // save POST goes out, and consumed by _relayCommit when the response lands.
-    // Never reconstructed from lastHtml: that is the last relay that COMPLETED,
-    // which lags the save whenever an earlier relay is still in flight, and
-    // pairing a fresh stamp with older bytes is the one thing spec §10 forbids.
+    // Never reconstructed from lastHtml: that is the newest accepted save or
+    // applied frame, which can still lag the save in flight, and pairing a fresh
+    // stamp with older bytes is the one thing spec §10 forbids.
     this._savedSnapshot = null;
     this._sendInFlight = false;
     this._queuedSend = null;
@@ -310,10 +312,9 @@ class LiveSync {
     // can resolve synthetic identities on its base tree.
     this._lastIdentityMap = null;
 
-    // Bumped whenever an APPLY (or a reset) rewrites lastHtml. A POST's
-    // success callback carries no ordering guarantee against the SSE stream,
-    // so a delayed response must not rewind lastHtml past a frame that
-    // applied while it was on the wire.
+    // Bumped whenever an APPLY (or a reset) rewrites lastHtml. The boot settle
+    // reads it: a lane a frame already replaced since start is not refreshed
+    // from whatever DOM that frame left behind.
     this._applyGen = 0;
 
     // Hold-retry timers, one per pending slot. A held frame's slot and seq
@@ -345,6 +346,12 @@ class LiveSync {
     this.onNotification = null;
   }
 
+  // Compatibility: the raw engine reports of every open loss. The ledger
+  // (clay.conflicts) is the real owner; nothing here removes a record.
+  get unresolvedConflicts() {
+    return conflicts.list().filter((c) => c.kind !== 'apply-incomplete');
+  }
+
   _log(message, data = null) {
     if (!this.debug) return;
     const prefix = `[LiveSync ${new Date().toISOString()}]`;
@@ -390,8 +397,7 @@ class LiveSync {
   _seedBases() {
     if (pageMaybeDirty()) return;
     const clone = captureSnapshot({ flushUndo: false });
-    this.lastHtml = serializeForSync(clone);
-    this._lastIdentityMap = this.identity.exportMap(clone, originalSnapshotNode);
+    this._setPeerBase(serializeForSync(clone), this.identity.exportMap(clone, originalSnapshotNode), this._ticket());
     this._setDiskBase(captureForSaveAndComparison({ emitForSync: false }).forSave, this._ticket());
   }
 
@@ -419,12 +425,14 @@ class LiveSync {
     // so mint a fresh resume id — this stream must not resume the previous one.
     this.lastHtml = null;
     this._lastIdentityMap = null;
+    // A ticket of its own, as the disk lane's reset takes: a save accepted or
+    // a frame settling from before this start cannot land in the new run.
+    this._peerBaseTicket = this._ticket();
     // The reset takes a ticket of its own, so a writer from before this start
     // (a save response still on the wire) cannot land in the new run.
     this._diskBase = null;
     this._diskBaseTicket = this._ticket();
     this._saveTicket = 0;
-    this.unresolvedConflicts = [];
     this._savedSnapshot = null;
     this._applyGen++;
     this.lastSeenSeq = 0;
@@ -445,6 +453,7 @@ class LiveSync {
     const gen = ++this._startGen;
     if (this.lane === 'live' && !baselineSettled()) {
       const applyGen = this._applyGen;
+      const morphTicket = this._morphTicket;
       const saveEpoch = this._saveEpoch;
       const startHtml = this.lastHtml;
       const startDiskTicket = this._diskBaseTicket;
@@ -462,6 +471,9 @@ class LiveSync {
         // A save this tab sent is still unconfirmed: what it carries is not yet
         // common history, and a refused save must merge against the older base.
         if (this._saveTicket !== 0) return;
+        // A frame morphed the page since start: its base is newer than
+        // anything the settle would capture.
+        if (this._morphTicket !== morphTicket) return;
         // Refresh each lane only while it still holds what start left. A frame, a
         // landed relay, an own save or a disk frame since then gave it a newer base
         // (an own save counts even when its relay failed and lastHtml never moved).
@@ -470,8 +482,7 @@ class LiveSync {
         // rewriting content the merge cannot reach.
         if (startHtml !== null && this._applyGen === applyGen && this._saveEpoch === saveEpoch && this.lastHtml === startHtml) {
           const clone = captureSnapshot({ flushUndo: false });
-          this.lastHtml = serializeForSync(clone);
-          this._lastIdentityMap = this.identity.exportMap(clone, originalSnapshotNode);
+          this._setPeerBase(serializeForSync(clone), this.identity.exportMap(clone, originalSnapshotNode), this._ticket());
         }
         if (startDiskSeeded && this._diskBaseTicket === startDiskTicket) {
           this._setDiskBase(captureForSaveAndComparison({ emitForSync: false }).forSave, this._ticket());
@@ -498,16 +509,9 @@ class LiveSync {
         // today) counts as now.
         const ticket = this._saveTicket || this._ticket();
         this._saveTicket = 0;
+        if (ticket > this._acceptedSaveTicket) this._acceptedSaveTicket = ticket;
         const bytes = getLastSavedBytes();
         if (bytes != null) this._setDiskBase(bytes, ticket);
-        // A save this tab made is the one act that acknowledges a lost
-        // conflict: the person wrote the page as it stands. Only the page as
-        // it stood at the capture: a conflict from a frame that applied after
-        // it is not in these bytes, and it keeps the page dirty.
-        this.unresolvedConflicts = this.unresolvedConflicts.filter(
-          (c) => this._conflictTickets.get(c) > ticket
-        );
-        if (this.unresolvedConflicts.length) gateMarkDirty();
         this._relayCommit();
       };
       document.addEventListener('clay:save-saved', this._saveSavedHandler);
@@ -522,7 +526,6 @@ class LiveSync {
         queueMicrotask(() => {
           if (this.isDestroyed) return;
           if (refusedBy !== lastSeenEtag()) return;
-          if (this.unresolvedConflicts.length) return;
           conflictResolvedBySync(refusedBy);
           this._saveAfterMerge(pageMaybeDirty(), false);
         });
@@ -836,7 +839,7 @@ class LiveSync {
       if (etag && html === this.lastHtml) {
         this._log(`Taking the stamp from a peer save of content already applied (seq=${seq})`);
         recordEtag(etag);
-        if (isSaveConflicted() && this.unresolvedConflicts.length === 0) {
+        if (isSaveConflicted()) {
           conflictResolvedBySync(etag);
           this._saveAfterMerge(pageMaybeDirty(), false);
         }
@@ -891,7 +894,7 @@ class LiveSync {
       // The save that follows this capture stores these bytes, so this is the
       // content its stamp will describe. Held for _relayCommit, and overwritten
       // by the next capture, so it always names the save currently in flight.
-      this._savedSnapshot = { html, identityMap };
+      this._savedSnapshot = { html, identityMap, ticket: this._saveTicket };
     };
 
     document.addEventListener('clay:snapshot-ready', this._snapshotHandler);
@@ -953,22 +956,29 @@ class LiveSync {
     // stored, and §10 is explicit that a stamp must never travel on its own.
     if (!pending || typeof pending.html !== 'string') return;
 
-    this._enqueueSend(pending.html, pending.identityMap, etag || null);
-  }
+    // Skip only an unstamped repeat, judged against the base as it stood. A
+    // landed save is news even when its bytes equal the last relay: "Keep mine"
+    // can restore exactly those bytes after the peers moved on, and they must
+    // hear it.
+    const repeat = !etag && pending.html === this.lastHtml;
 
-  _postUpdate(html, identityMap, etag = null, attempt = 0) {
-    // Skip only an unstamped repeat. A landed save is news even when its bytes
-    // equal the last relay: "Keep mine" can restore exactly those bytes after
-    // the peers moved on, and they must hear it.
-    if (!etag && html === this.lastHtml) {
+    // The host accepted these bytes, so every later accepted save descends from
+    // them: they are the peer lane's base from this moment, not once the relay
+    // returns. A frame whose morph ran after this capture installs its own,
+    // newer base when its resources settle, and the ticket keeps it there.
+    this._setPeerBase(pending.html, pending.identityMap, pending.ticket);
+
+    if (repeat) {
       this._log('Skipping send - HTML unchanged');
       return;
     }
+    this._enqueueSend(pending.html, pending.identityMap, etag || null);
+  }
 
-    this._log(`Sending update (HTML length: ${html.length}, lastHtml length: ${this.lastHtml?.length || 0})`);
+  _postUpdate(html, identityMap, etag = null, attempt = 0) {
+    this._log(`Sending update (HTML length: ${html.length})`);
 
     this._sendInFlight = true;
-    const gen = this._applyGen;
     let retry = false;
 
     // Absolute against the real origin, so a <base href> in the page cannot
@@ -987,18 +997,7 @@ class LiveSync {
         ...(etag ? { etag } : {})
       })
     }).then(response => {
-      if (response.ok) {
-        // A frame that applied while this POST was on the wire has already
-        // advanced lastHtml past this snapshot; assigning would rewind the
-        // diff base to pre-frame state and misclassify the frame's content
-        // as local edits on the next dirty apply.
-        if (this._applyGen === gen) {
-          this.lastHtml = html;
-          this._lastIdentityMap = identityMap || null;
-        } else {
-          this._log('Skipping lastHtml advance: a frame applied during the POST');
-        }
-      } else {
+      if (!response.ok) {
         console.warn('[LiveSync] Save returned status:', response.status);
         retry = response.status >= 500 || response.status === 408 || response.status === 429;
       }
@@ -1284,6 +1283,22 @@ class LiveSync {
     this._diskBaseTicket = ticket;
   }
 
+  /**
+   * The one writer of the peer lane's base. Keeps the newest moment: a save
+   * accepted after a later frame's morph, or a frame whose resource wait
+   * outlasts a later save, can no longer rewind it.
+   */
+  _setPeerBase(html, identityMap, ticket) {
+    if (ticket < this._peerBaseTicket) return false;
+    this._peerBaseTicket = ticket;
+    this.lastHtml = html;
+    this._lastIdentityMap =
+      identityMap && typeof identityMap === 'object' && !Array.isArray(identityMap)
+        ? identityMap
+        : null;
+    return true;
+  }
+
   _requestFrame(cb) {
     if (typeof window !== 'undefined' && typeof window.requestAnimationFrame === 'function') {
       return window.requestAnimationFrame(cb);
@@ -1323,7 +1338,7 @@ class LiveSync {
    * @param {boolean} lane.synthetic - whether this tab's synthetic ids apply
    * @param {object} [lane.extra] - extra mergeDocument options (the disk lane's beforeApply)
    */
-  async _mergeIncoming(html, identityMap, { base, baseIdentityMap = null, captureLocal, synthetic, extra = {} }) {
+  async _mergeIncoming(html, identityMap, { base, baseIdentityMap = null, captureLocal, synthetic, source = 'peer', seq = null, etag = null, extra = {} }) {
     const store = this.identity;
     // A frame may neither write these onto our root nor, by not carrying them,
     // take ours away. Returning false is hyper-morph's veto for both directions.
@@ -1363,6 +1378,7 @@ class LiveSync {
       remoteWins: (el) => el.matches(REMOTE_WINS_SELECTOR),
       ignoreAttribute: isRootLocalAttr,
       protectFocusedValue: true,
+      keepLiveOnly: source === 'peer',
       scripts: { mergeTags: mergeTagRecognizers },
       hooks: { beforeAttributeUpdated },
       ...extra,
@@ -1377,10 +1393,13 @@ class LiveSync {
     // loaded and run. Resuming mutations earlier would let late scripts' DOM
     // changes look like user edits and echo back out.
     let pending;
+    let localRoot = null;
+    let applyId = null;
     if (base == null) {
       pending = HyperMorph.mergeDocument({
         ...common,
         base: null,
+        local: { root: captureLocal(), toLive: originalSnapshotNode },
         identity: { local: localIdentity, remote: sideIdentity(identityMap) },
       });
     } else if (!dirty) {
@@ -1399,6 +1418,7 @@ class LiveSync {
         ...common,
         base: baseDoc,
         local: { root: localRoot, toLive: originalSnapshotNode },
+        fastPath: true,
         identity: {
           base: localIdentity,
           local: localIdentity,
@@ -1406,41 +1426,47 @@ class LiveSync {
         },
       });
     } else {
-      pending = HyperMorph.mergeDocument({
-        ...common,
-        base,
-        local: { root: captureLocal(), toLive: originalSnapshotNode },
-        identity: {
-          base: sideIdentity(baseIdentityMap),
-          local: localIdentity,
-          remote: sideIdentity(identityMap),
-        },
+      localRoot = captureLocal();
+      applyId = beginApply({
+        source, seq, etag, root: localRoot,
+        domain: source === 'disk' ? 'save' : 'sync',
       });
+      try {
+        pending = HyperMorph.mergeDocument({
+          ...common,
+          base,
+          local: { root: localRoot, toLive: originalSnapshotNode },
+          identity: {
+            base: sideIdentity(baseIdentityMap),
+            local: localIdentity,
+            remote: sideIdentity(identityMap),
+          },
+        });
+      } catch (err) {
+        failApply(applyId, err);
+        throw err;
+      }
     }
     // The apply itself ran synchronously inside mergeDocument; only resource
     // loads are still pending. This is the moment the frame's bytes were true
     // of the document, so the lane dates its base here, not after the await:
     // a save that captures during the wait is newer than this frame.
     const ticket = this._ticket();
-    const report = await pending;
+    this._morphTicket = ticket;
+    let report;
+    try {
+      report = await pending;
+    } catch (err) {
+      if (applyId) failApply(applyId, err, { ticket });
+      throw err;
+    }
     const typedDuringWait = gateCaptureToken().gen !== token.gen;
 
-    // A conflict the frame won leaves this tab's text in report.conflicts and
-    // nowhere else. It is kept until this tab's next successful save, so the
-    // page stays dirty (the close warning holds) however many clean frames
-    // follow, and nothing writes the page out from under it automatically.
-    if (dirty && report.conflicts.length) {
-      for (const c of report.conflicts) this._conflictTickets.set(c, ticket);
-      this.unresolvedConflicts.push(...report.conflicts);
-    }
-    // Clean only when nothing of this tab's survived, nothing of it was lost,
-    // and nothing lost earlier is still waiting on a save.
-    if (
-      dirty &&
-      !report.localDiverged &&
-      report.conflicts.length === 0 &&
-      this.unresolvedConflicts.length === 0
-    ) {
+    // What the frame won over this tab's unsaved edits goes to the ledger with
+    // the clone the merge read as "mine". Earlier losses live in the ledger,
+    // not in the page's dirty state.
+    const conflictIds = applyId ? completeApply(applyId, report.conflicts, { ticket }) : [];
+    if (dirty && !report.localDiverged) {
       gateClearIfUnchanged(token);
     }
     // Synthetic ids converge: every live element the frame named takes the
@@ -1451,20 +1477,18 @@ class LiveSync {
       const synthetic = mapIds.has(id) ? id : syntheticByAuthored.get(id);
       if (synthetic) store.adopt(el, synthetic);
     }
-    return { report, ticket, typedDuringWait };
+    return { report, ticket, typedDuringWait, conflictIds };
   }
 
   /**
    * The automatic save a merge may owe: the merge kept this tab's edits
    * (convergence), or the person typed during the awaited apply (the mutation
    * feed was paused, so nothing else will schedule it). Only where autosave is
-   * on, and never over an unresolved conflict: that save would write the page
-   * with the lost text gone and clear the one signal that says so.
+   * on.
    */
   _saveAfterMerge(diverged, typedDuringWait) {
     if (!(diverged || typedDuringWait)) return;
     if (!autosaveActive()) return;
-    if (this.unresolvedConflicts.length) return;
     savePageThrottled();
   }
 
@@ -1538,11 +1562,14 @@ class LiveSync {
       // knowingly missing what disk holds, and a stamp there would let its next
       // save replace that change with nobody told.
 
-      const { report, typedDuringWait: typed } = await this._mergeIncoming(html, identityMap, {
+      const { report, ticket, typedDuringWait: typed, conflictIds } = await this._mergeIncoming(html, identityMap, {
         base: this.lastHtml,
         baseIdentityMap: this._lastIdentityMap,
         captureLocal: () => captureSnapshot({ flushUndo: false }),
         synthetic: true,
+        source: 'peer',
+        seq,
+        etag,
       });
       diverged = report.localDiverged;
       typedDuringWait = typed;
@@ -1561,11 +1588,9 @@ class LiveSync {
       // two of a burst would read the protected section as clean and clobber
       // it) and could dedupe away the convergence send. Convergence is driven
       // by the explicit save below instead.
-      this.lastHtml = html;
-      this._lastIdentityMap =
-        identityMap && typeof identityMap === 'object' && !Array.isArray(identityMap)
-          ? identityMap
-          : null;
+      // A save captured during this frame's resource wait and already accepted
+      // is newer than the frame: it keeps the base, and its stamp too.
+      this._setPeerBase(html, identityMap, ticket);
       this._applyGen++;
 
       // The stamp of section 6, taken now that the bytes it describes are the
@@ -1573,7 +1598,7 @@ class LiveSync {
       // above, and deliberately the same moment: the two claims a page makes
       // when it adopts a stamp are "the host stores this version" and "I hold
       // it", and only the second one is this tab's to make.
-      if (typeof etag === 'string' && etag) {
+      if (!(this._acceptedSaveTicket > ticket) && typeof etag === 'string' && etag) {
         recordEtag(etag);
         stamped = true;
       }
@@ -1598,13 +1623,10 @@ class LiveSync {
       // gate or a diverged merge leaves the base where it was, and the
       // convergence save moves it once the merge is on disk.
       //
-      // Unresolved conflicts keep every saved baseline where it is too: the
-      // page is dirty by definition until this tab saves.
       if (
         this.lane === 'live' &&
         !diverged &&
-        !pageMaybeDirty() &&
-        this.unresolvedConflicts.length === 0
+        !pageMaybeDirty()
       ) {
         const { forSave, forComparison, forDirty } = captureForSaveAndComparison({
           emitForSync: false,
@@ -1631,7 +1653,7 @@ class LiveSync {
       // returns above without reaching here, so nothing can name an author for a
       // change this tab never took. Null on every frame the host did not stamp.
       document.dispatchEvent(new CustomEvent('clay:sync-applied', {
-        detail: { seq, source: 'peer', by: by || null, report }
+        detail: { seq, source: 'peer', by: by || null, report, unresolved: this.unresolvedConflicts, conflictIds }
       }));
     } finally {
       this._log('applyUpdate - morph complete, resuming mutations');
@@ -1650,9 +1672,7 @@ class LiveSync {
     // isPaused is lifted so the convergence save's relay reaches peers.
     // Only where autosave is on: a manual-save page must never auto-write, so
     // there the merge stays local, still dirty, until the person saves.
-    // Not over a lost conflict: the hold and its bar stay up as the signal that
-    // this tab lost text, until the person saves.
-    if (stamped && this.unresolvedConflicts.length === 0) conflictResolvedBySync(etag);
+    if (stamped) conflictResolvedBySync(etag);
     this._saveAfterMerge(diverged, typedDuringWait);
   }
 
@@ -1717,10 +1737,13 @@ class LiveSync {
       // file. The merged document is activated for edit mode before it is
       // applied, exactly as boot would have, so every node, local or incoming,
       // goes live from its own saved form.
-      const { report, ticket, typedDuringWait: typed } = await this._mergeIncoming(html, null, {
+      const { report, ticket, typedDuringWait: typed, conflictIds } = await this._mergeIncoming(html, null, {
         base: this._diskBase,
         captureLocal: () => captureForMerge().saveClone,
         synthetic: false,
+        source: 'disk',
+        seq,
+        etag,
         extra: { beforeApply: (doc) => activateIncomingDoc(doc.documentElement) },
       });
       diverged = report.localDiverged;
@@ -1748,8 +1771,7 @@ class LiveSync {
       if (
         this.lane === 'live' &&
         !diverged &&
-        !pageMaybeDirty() &&
-        this.unresolvedConflicts.length === 0
+        !pageMaybeDirty()
       ) {
         // Clean apply: the DOM now IS the disk state, so a local comparison
         // capture of it is the truthful baseline. The next no-op save skips,
@@ -1765,8 +1787,7 @@ class LiveSync {
         // newer peer frame. Rebuild it exactly the way the send pipeline
         // does, so it stays in the snapshot domain.
         const clone = captureSnapshot({ flushUndo: false });
-        this.lastHtml = serializeForSync(clone);
-        this._lastIdentityMap = this.identity.exportMap(clone, originalSnapshotNode);
+        this._setPeerBase(serializeForSync(clone), this.identity.exportMap(clone, originalSnapshotNode), ticket);
         this._applyGen++;
       }
 
@@ -1780,6 +1801,8 @@ class LiveSync {
           // so this tab's next save copies from the file somebody else just wrote.
           html,
           report,
+          conflictIds,
+          unresolved: this.unresolvedConflicts,
         }
       }));
     } finally {
@@ -1794,9 +1817,7 @@ class LiveSync {
     // (our edits + their bytes). The baseline was left pre-external, so the
     // save sees both as changes and writes the merge back. Only where
     // autosave is on, as in the peer lane.
-    // Not over a lost conflict: the hold and its bar stay up as the signal that
-    // this tab lost text, until the person saves.
-    if (stamped && this.unresolvedConflicts.length === 0) conflictResolvedBySync(etag);
+    if (stamped) conflictResolvedBySync(etag);
     this._saveAfterMerge(diverged, typedDuringWait);
   }
 
@@ -1860,5 +1881,5 @@ if (typeof window !== 'undefined') {
 // Export for the clayjs module system. The class itself is exported so
 // tests can create fresh instances without driving the singleton's
 // EventSource/snapshot wiring.
-export { liveSync, LiveSync, morph, WIRE_PROFILES };
+export { liveSync, LiveSync, morph, WIRE_PROFILES, conflicts, SYNC_IGNORE_SELECTOR, REMOTE_WINS_SELECTOR };
 export default liveSync;